The great strength of electronic mail (“e-mail”) is the universal use of standard protocols that define the content and delivery of e-mail messages. Unfortunately, these standard protocols do not authenticate sender identities, making access control over e-mail a difficult proposition. In recent years, the lack of access control over e-mail has led to dramatic increases in the volume of commercial and other undesired messages (“spam”).
For over ten years, there have been hundreds of attempts to create a software system to control access to e-mail inboxes.
At the time of this application filing, it is a widely held belief that existing anti-spam technologies fail to solve the spam problem in e-mail, to the extent that there are predictions that spam has put the medium in jeopardy of becoming unusable.
The most common approach is what is collectively known as “spam filtering”. Spam filters attempt to determine whether or not a message is desired based on an assessment of its content, the identity of the sender, or some other characteristic of the message.
Filters tend to suffer from one or several common deficiencies. Filters frequently miss spam messages and allow their delivery and also incorrectly identify legitimate messages as spam (“false positive”). It's problem enough to miss significant numbers of spam, but blocking legitimate messages is simply intolerable for most users, especially in business where the filtered message could be of critical importance.
Filters are easily bypassed since the properties on which filters depend to identify spam are frequently under the control of the sender (e.g. sender's identity, subject, message content).
Rules-based filters require ongoing maintenance of the rules by users and administrators. Filters can be computationally expensive, as each message much be processed through all of the rules leading to latency in message delivery.
A second approach to limiting access over electronic communications is to deny all access other than from authenticated sources, a technique typically known as “white listing”. It's a system that allows messages to arrive “by invitation only”.
When a message is sent to a white list-protected e-mail address, the message is delivered only if the sender's identity is found on the white list. Messages from senders not on the white list are rejected, quarantined as suspect spam, or most-commonly, challenged. Each rejection behavior introduces it's own aggravation and disruption to legitimate communications.
White listing works because most spam senders do not want to receive reply messages, so message-based challenges mostly arrive to legitimate message senders only.
Changes to the underlying e-mail protocols will not bring relief. The IETF (the body that defines and supports the RFC e-mail standards) already defined an authentication extension to standard e-mail communications in 1999 called ESMTP. Yet even though ESMTP has been with us for four years, few if any mail hosts require the use of ESMTP by senders because to do so would be to deny the vast majority of messages sent with universal non-authenticated standard (SMTP). So no one will move to the ESMTP standard until everyone does, resulting in a continued and permanent dependency on SMTP.
Commercial schemes that try to put a monetary control system (e.g. pay-per-message e-mail and bonded e-mail) over e-mail or that try to draw from legal intellectual property protection (e.g. trademarked poetry in message headers) require too much setup and follow-up aggravation to be acceptable to the majority of users.
The key insight that led to the present invention was accepting that it is very difficult, if not impossible, to design a system that separates all desired from undesired messages when mixed in a single collection. The numerous attempts that attempted to do so have not delivered complete protection against spam without blocking legitimate messages.
The solution resides in a system or method that can be adopted unilaterally by a user or enterprise that prevents desired and undesired messages from being mixed in the same collection.